The complaint filed in California accuses the business network of using a "weak encryption format" for users' information and not having crucial security measures in place.

A LinkedIn spokesperson told The Register that the class action suit's claims were "without merit".

"No member account has been breached as a result of the incident, and we have no reason to believe that any LinkedIn member has been injured," the company said. "Therefore, it appears that these threats are driven by lawyers looking to take advantage of the situation.

"We believe these claims are without merit, and we will defend the company vigorously against suits trying to leverage third-party criminal behaviour."

The 6.5 million user passwords hacked and posted online were in hashed format, but the biz site evidently had not applied any salts. Salting adds extra arbitrary data to a password when it is hashed, thwarting pre-generated tables and making life more difficult for password crackers. The class action suit claims that hashing without salting is not an "industry standard protocol" as promised by LinkedIn's privacy policy.

The case also latches on to reports that LinkedIn was hacked through an SQL injection attack, which uses weaknesses in a company's website to get into its back-end systems.

"If true, LinkedIn's failure to adequately protect its website against SQL injection attacks - in conjunction with improperly securing its users' personally identifiable information - would demonstrate that the company employed a troubling lack of security measures," the complaint said.

Naturally, the class action suit is looking for attorney fees and damages for US members of LinkedIn. ®